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CLAIMS 

1. A count ermeasure method for implementation in 
an electronic component and implementing a public-key 

5 cryptography algorithm comprising exponentiation 
computation of the type y=g^d, where g and y are 
elements of the determined group G written in 
multiplicative notation, and d is a predetermined 
number, said countermeasure method being characterized 

10 in that it comprises a masking first step for 
expressing the exponent d randomly in the form 
d=d2.s+di, where di, d2, and s are integers and a second 
step for computing the value of y=g^d in G by any 
double exponentiation algorithm of the type 

15 (g^di) . {h^d2) with h=g^s in G. 

2. A countermeasure method according to claim 1, 
characterized in that the group G is written in 
additive notation . 

3. A countermeasure method according to claim 1, 
2 0 characterized in that the method comprises the 

following steps: 

1) Masking of d: 

la) Express d randomly in the form d=d2-s+di, 
where di, 6.2, and s are integers 
25 lb) Let {di(t) ,di(t-l) ,.,.,di(0) ) and 

(d2 (t) , d2 (t-1) , ...,d2 (0) ) be the respective 
binary representations of di and of d2 

2) Double exponentiation: 

2a) Define (compute) the element h=g^s in G 



22 



2b) Initialize the register A with the 

neutral element of G 
2c) For i from t down to 0, do the following: 
2cl) Replace A with A'^2 
5 2c2) If di(i)=l, replace A with A.g 

2c3) If d2(i)=l/ replace A with A.h 
2c4) Return A. 
4. A countermeasure method according to claim 1, 
characterized in that the method comprises the 
10 following steps: 

1) Masking of d: 

la) Express d randomly in the form d=d2.s+di, 
where di, d2, and s are integers 
lb) Let (di(t) ,di(t-l) ,...,di(0) ) and 

15 (d2 (t ) , d2 (t-1) , d2 (0) ) be the respective 

binary representations of di and of d2 

2) Double exponentiation: 

2a) Define (compute) the element h=g'^s in G 
2b) Precompute u=g.h in G 
20 2c) Initialize the register A with the 

neutral element of G 
2d) For i from t down to 0, do the following: 

2dl) Replace A with A'^2 

2d2) If di(i)=l and d2(i)=0, replace A 
25 with A.g 

2d3) If di(i)=0 and d2(i)=l, replace A 
with A.h 

2d4) If di(i)=l and d2(i)=l, replace A 
with A.u 

3 0 2d5) Return A. 
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5 . A countermeasure method according to claim 2 , 
characterized in that the method comprises the 
following steps: 

1) Masking of d: 

5 la) Express d randomly in the form d=d2.s+di, 

where di, (±2, and s are integers 
lb) Let (di (t) ,di (t-1) ,„.,di (0) ) and 

(d2 (t) ,d2 (t-1) ,...,d2 (0) ) be the respective 
binary signed-digit representations for 
10 di and for d2 

2 ) Exponent iat ion : 

2a) Define (compute) the point R=s*P in G 
2b) Initialize a register A with the neutral 
element of G 

15 2c) For i from t down to 0, do the following: 

2cl) Replace A with 2*A 

2c2) If di(i) is non-zero, replace A 

with A+di (i) *P 
2c3) If d2(i) is non-zero, replace A 

2 0 with A+da (i) *R 

2c4) Return A. 

6 . A countermeasure method according to any 
preceding claim, characterized in that, in the masking 
first step, expressing the exponent d randomly in the 

25 form d=d2.s+di, where di, d2, and s are integers, 
consists in choosing a random integer s and in taking d2 
equal to the default value of the integer division of d 
by s, and di equal to the remainder of said division. 

7 . A countermeasure method according to any one 

3 0 of claims 1 to 5, characterized in that expressing the 
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exponent d randomly in the form d=d2.s+di, where di, d2, 
and s are integers, consists in choosing a random 
integer di, in setting s to the value 1, and in taking 
d2 equal to the difference between d and di . 
5 8- An electronic component implementing the 

method according to any preceding claim. 



